IT博客汇
  • 首页
  • 精华
  • 技术
  • 设计
  • 资讯
  • 扯淡
  • 权利声明
  • 登录 注册

    FreeBSD:启用SSH + 启用root登录

    Adamhuan发表于 2017-05-26 09:10:21
    love 0

    默认情况下,FreeBSD是不支持root用户的SSH远程访问的,如果你一定要这么连接,你将会遇到如下所示的样子的错误告警:

    或者这样的错误:

    [root@redis python]# ssh 192.168.92.171
    Password for root@freebsd:
    Password for root@freebsd:
    Password for root@freebsd:
    Permission denied (publickey,keyboard-interactive).
    [root@redis python]#

    如果遇到了这样的问题,你需要对FreeBSD的SSHD做出配置上的修改:
    修改后,我的配置文件【/etc/ssh/sshd_config】的状态是这样的:

    root@freebsd:~ # cat /etc/ssh/sshd_config 
    #       $OpenBSD: sshd_config,v 1.98 2016/02/17 05:29:04 djm Exp $
    #       $FreeBSD: releng/11.0/crypto/openssh/sshd_config 296633 2016-03-11 00:15:29Z des $
    
    # This is the sshd server system-wide configuration file.  See
    # sshd_config(5) for more information.
    
    # This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
    
    # The strategy used for options in the default sshd_config shipped with
    # OpenSSH is to specify options with their default value where
    # possible, but leave them commented.  Uncommented options override the
    # default value.
    
    # Note that some of FreeBSD's defaults differ from OpenBSD's, and
    # FreeBSD has a few additional options.
    
    #Port 22
    #AddressFamily any
    #ListenAddress 0.0.0.0
    #ListenAddress ::
    
    # The default requires explicit activation of protocol 1
    #Protocol 2
    
    # HostKey for protocol version 1
    #HostKey /etc/ssh/ssh_host_key
    # HostKeys for protocol version 2
    #HostKey /etc/ssh/ssh_host_rsa_key
    #HostKey /etc/ssh/ssh_host_dsa_key
    #HostKey /etc/ssh/ssh_host_ecdsa_key
    #HostKey /etc/ssh/ssh_host_ed25519_key
    
    # Lifetime and size of ephemeral version 1 server key
    #KeyRegenerationInterval 1h
    #ServerKeyBits 1024
    
    # Ciphers and keying
    #RekeyLimit default none
    
    # Logging
    # obsoletes QuietMode and FascistLogging
    #SyslogFacility AUTH
    #LogLevel INFO
    
    # Authentication:
    
    #LoginGraceTime 2m
    #PermitRootLogin no
    #StrictModes yes
    #MaxAuthTries 6
    #MaxSessions 10
    
    #RSAAuthentication yes
    #PubkeyAuthentication yes
    
    # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
    #AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2
    
    #AuthorizedPrincipalsFile none
    
    #AuthorizedKeysCommand none
    #AuthorizedKeysCommandUser nobody
    
    # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
    #RhostsRSAAuthentication no
    # similar for protocol version 2
    #HostbasedAuthentication no
    # Change to yes if you don't trust ~/.ssh/known_hosts for
    # RhostsRSAAuthentication and HostbasedAuthentication
    #IgnoreUserKnownHosts no
    # Don't read the user's ~/.rhosts and ~/.shosts files
    #IgnoreRhosts yes
    
    # Change to yes to enable built-in password authentication.
    #PasswordAuthentication no
    #PermitEmptyPasswords no
    
    # Change to no to disable PAM authentication
    #ChallengeResponseAuthentication yes
    
    # Kerberos options
    #KerberosAuthentication no
    #KerberosOrLocalPasswd yes
    #KerberosTicketCleanup yes
    #KerberosGetAFSToken no
    
    # GSSAPI options
    #GSSAPIAuthentication no
    #GSSAPICleanupCredentials yes
    
    # Set this to 'no' to disable PAM authentication, account processing,
    # and session processing. If this is enabled, PAM authentication will
    # be allowed through the ChallengeResponseAuthentication and
    # PasswordAuthentication.  Depending on your PAM configuration,
    # PAM authentication via ChallengeResponseAuthentication may bypass
    # the setting of "PermitRootLogin without-password".
    # If you just want the PAM account and session checks to run without
    # PAM authentication, then enable this but set PasswordAuthentication
    # and ChallengeResponseAuthentication to 'no'.
    #UsePAM yes
    
    #AllowAgentForwarding yes
    #AllowTcpForwarding yes
    #GatewayPorts no
    #X11Forwarding yes
    #X11DisplayOffset 10
    #X11UseLocalhost yes
    #PermitTTY yes
    #PrintMotd yes
    #PrintLastLog yes
    #TCPKeepAlive yes
    #UseLogin no
    #UsePrivilegeSeparation sandbox
    #PermitUserEnvironment no
    #Compression delayed
    #ClientAliveInterval 0
    #ClientAliveCountMax 3
    #UseDNS yes
    #PidFile /var/run/sshd.pid
    #MaxStartups 10:30:100
    #PermitTunnel no
    #ChrootDirectory none
    #VersionAddendum FreeBSD-20160310
    
    # no default banner path
    #Banner none
    
    # override default of no subsystems
    Subsystem       sftp    /usr/libexec/sftp-server
    
    # Example of overriding settings on a per-user basis
    #Match User anoncvs
    #       X11Forwarding no
    #       AllowTcpForwarding no
    #       PermitTTY no
    #       ForceCommand cvs server
    
    # adamhuan changed
    PasswordAuthentication yes
    PermitRootLogin yes
    root@freebsd:~ #

    而其中关键的位置,在这里:

    root@freebsd:~ # cat /etc/ssh/sshd_config | grep --color -E "PermitRootLogin|PasswordAuthentication|PermitEmptyPasswords"
    #PermitRootLogin no
    #PasswordAuthentication no
    #PermitEmptyPasswords no
    # PasswordAuthentication.  Depending on your PAM configuration,
    # the setting of "PermitRootLogin without-password".
    # PAM authentication, then enable this but set PasswordAuthentication
    PasswordAuthentication yes
    PermitRootLogin yes
    root@freebsd:~ #

    具体意思:
    PermitRootLogin,是否允许root登录
    PermitEmptyPassword,是否允许空密码登录
    PasswordAuthentication,是否使用口令验证

    ————————
    另外,FreeBSD中的SSH服务可能也不是默认打开的,你可以按照下面的方式去启用。

    查看服务是否运行:

    root@freebsd:~ # service sshd status
    sshd is running as pid 785.
    root@freebsd:~ #

    查看端口的监听状态:

    root@freebsd:~ # netstat -an | grep --color 22
    tcp4       0      0 192.168.92.171.22      192.168.92.1.4765      ESTABLISHED
    tcp4       0      0 *.22                   *.*                    LISTEN
    tcp6       0      0 *.22                   *.*                    LISTEN
    root@freebsd:~ #

    查看是否激活了SSH服务:

    root@freebsd:~ # cat /etc/rc.conf
    hostname="freebsd"
    ifconfig_em0="DHCP"
    ifconfig_em0_ipv6="inet6 accept_rtadv"
    sshd_enable="YES"
    # Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable
    dumpdev="AUTO"
    root@freebsd:~ # 
    root@freebsd:~ # cat /etc/rc.conf | grep --color ssh
    sshd_enable="YES"
    root@freebsd:~ #

    除了上面这些,还有一个地方记录了与SSH有关的信息:

    root@freebsd:~ # cat /etc/inetd.conf | grep --color ssh
    #ssh    stream  tcp     nowait  root    /usr/sbin/sshd          sshd -i -4
    #ssh    stream  tcp6    nowait  root    /usr/sbin/sshd          sshd -i -6
    root@freebsd:~ #

    ——————————
    这样,完成了上述配置之后,用root用户ssh登录FreeBSD就应该没有问题了:

    [root@redis python]# ssh 192.168.92.171
    Password for root@freebsd:
    Last login: Fri May 26 16:55:45 2017 from 192.168.92.1
    FreeBSD 11.0-RELEASE-p1 (GENERIC) #0 r306420: Thu Sep 29 01:43:23 UTC 2016
    
    Welcome to FreeBSD!
    
    Release Notes, Errata: https://www.FreeBSD.org/releases/
    Security Advisories:   https://www.FreeBSD.org/security/
    FreeBSD Handbook:      https://www.FreeBSD.org/handbook/
    FreeBSD FAQ:           https://www.FreeBSD.org/faq/
    Questions List: https://lists.FreeBSD.org/mailman/listinfo/freebsd-questions/
    FreeBSD Forums:        https://forums.FreeBSD.org/
    
    Documents installed with the system are in the /usr/local/share/doc/freebsd/
    directory, or can be installed later with:  pkg install en-freebsd-doc
    For other languages, replace "en" with a language code like de or fr.
    
    Show the version of FreeBSD installed:  freebsd-version ; uname -a
    Please include that output and any error messages when posting questions.
    Introduction to manual pages:  man man
    FreeBSD directory layout:      man hier
    
    Edit /etc/motd to change this login announcement.
    root@freebsd:~ # 
    root@freebsd:~ # exit
    logout
    Connection to 192.168.92.171 closed.
    [root@redis python]#

    ——————————————————
    Done。



沪ICP备19023445号-2号
友情链接